ALSA-2026:98119: Important: vim security, bug fix, and enhancement update
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code execution (CVE-2026-43961)
Bug Fix(es) and Enhancement(s):
vim writes file in place even though creating a backup is possible [rhel-8.10.z] (JIRA:RHEL-282852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/vim-X11to a version that resolves this vulnerability.Fixed in 2:8.0.1763-34.el8_10 - Upgrade
Upgrade
almalinux/vim-commonto a version that resolves this vulnerability.Fixed in 2:8.0.1763-34.el8_10 - Upgrade
Upgrade
almalinux/vim-enhancedto a version that resolves this vulnerability.Fixed in 2:8.0.1763-34.el8_10 - Upgrade
Upgrade
almalinux/vim-filesystemto a version that resolves this vulnerability.Fixed in 2:8.0.1763-34.el8_10 - Upgrade
Upgrade
almalinux/vim-minimalto a version that resolves this vulnerability.Fixed in 2:8.0.1763-34.el8_10
Event History
Frequently Asked Questions
Does this update include minimal Vim installations?
Yes. The affected package list includes almalinux/vim-minimal, along with vim-common, vim-enhanced, vim-filesystem, and vim-x11.